Edit tour
Windows
Analysis Report
QNuQ5e175D.exe
Overview
General Information
| Sample name: | QNuQ5e175D.exerenamed because original name is a hash value |
| Original sample name: | e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe |
| Analysis ID: | 1588755 |
| MD5: | 9bb2cdb8508ee2255a35ecec43462a48 |
| SHA1: | c7465e8b0a3ae61b23520752afbb8bf89a3cecdd |
| SHA256: | e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa |
| Tags: | exesigneduser-adrian__luca |
| Infos: |  |
 | |
Detection
GuLoader
| Score: | 68 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Yara detected GuLoader
AI detected suspicious sample
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Contains functionality for read data from the clipboard
Contains functionality to dynamically determine API calls
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
QNuQ5e175D.exe (PID: 7408 cmdline: "C:\Users\ user\Deskt op\QNuQ5e1 75D.exe" MD5: 9BB2CDB8508EE2255A35ECEC43462A48) - QNuQ5e175D.exe (PID: 7776 cmdline:
"C:\Users\ user\Deskt op\QNuQ5e1 75D.exe" MD5: 9BB2CDB8508EE2255A35ECEC43462A48)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| CloudEyE, GuLoader | CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored. | No Attribution |
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security | ||
| JoeSecurity_GuLoader_2 | Yara detected GuLoader | Joe Security |
⊘No Sigma rule has matched
| Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T05:13:09.535463+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49736 | 142.250.184.206 | 443 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | |||
| Source: | Virustotal: | Perma Link | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004068D4 | |
| Source: | Code function: | 0_2_00405C83 | |
| Source: | Code function: | 0_2_00402930 | |
| Source: | Code function: | 4_2_00402930 | |
| Source: | Code function: | 4_2_004068D4 | |
| Source: | Code function: | 4_2_00405C83 | |
| Source: | JA3 fingerprint: | ||
| Source: | Suricata IDS: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | Code function: | 0_2_0040573B | |
| Source: | Code function: | 0_2_00403552 | |
| Source: | Code function: | 4_2_00403552 | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00406DE6 | |
| Source: | Code function: | 0_2_004075BD | |
| Source: | Code function: | 0_2_6FC41BFF | |
| Source: | Code function: | 4_2_00406DE6 | |
| Source: | Code function: | 4_2_004075BD | |
| Source: | Code function: | ||
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Classification label: | ||
| Source: | Code function: | 0_2_00403552 | |
| Source: | Code function: | 4_2_00403552 | |
| Source: | Code function: | 0_2_004049E7 | |
| Source: | Code function: | 0_2_004021CF | |
| Source: | File created: | Jump to behavior | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | ReversingLabs: | ||
| Source: | Virustotal: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Static PE information: | ||
Data Obfuscation | |
|---|
| Source: | File source: | ||
| Source: | File source: | ||
| Source: | Code function: | 0_2_6FC41BFF | |
| Source: | Code function: | 0_2_6FC430EE | |
| Source: | File created: | Jump to dropped file | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
Malware Analysis System Evasion | |
|---|
| Source: | API/Special instruction interceptor: | ||
| Source: | API/Special instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | RDTSC instruction interceptor: | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Last function: | ||
| Source: | Code function: | 0_2_004068D4 | |
| Source: | Code function: | 0_2_00405C83 | |
| Source: | Code function: | 0_2_00402930 | |
| Source: | Code function: | 4_2_00402930 | |
| Source: | Code function: | 4_2_004068D4 | |
| Source: | Code function: | 4_2_00405C83 | |
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | API call chain: | graph_0-4192 | ||
| Source: | API call chain: | graph_0-4195 | ||
| Source: | Code function: | 0_2_6FC41BFF | |
| Source: | Process created: | Jump to behavior | ||
| Source: | Code function: | 0_2_00403552 | |
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 1 Native API | 1 DLL Side-Loading | 1 Access Token Manipulation | 11 Masquerading | OS Credential Dumping | 21 Security Software Discovery | Remote Services | 1 Archive Collected Data | 11 Encrypted Channel | Exfiltration Over Other Network Medium | 1 System Shutdown/Reboot |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 11 Process Injection | 1 Virtualization/Sandbox Evasion | LSASS Memory | 1 Virtualization/Sandbox Evasion | Remote Desktop Protocol | 1 Clipboard Data | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | 1 DLL Side-Loading | 1 Access Token Manipulation | Security Account Manager | 2 File and Directory Discovery | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 23 System Information Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Deobfuscate/Decode Files or Information | LSA Secrets | Internet Connection Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 2 Obfuscated Files or Information | Cached Domain Credentials | Wi-Fi Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
| DNS | Web Services | External Remote Services | Systemd Timers | Startup Items | Startup Items | 1 DLL Side-Loading | DCSync | Remote System Discovery | Windows Remote Management | Web Portal Capture | Commonly Used Port | Exfiltration Over C2 Channel | Inhibit System Recovery |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 45% | ReversingLabs | Win32.Spyware.Snakekeylogger | ||
| 64% | Virustotal | Browse |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | ReversingLabs | |||
| 0% | Virustotal | Browse |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| drive.google.com | 142.250.184.206 | true | false | high | |
| drive.usercontent.google.com | 172.217.16.193 | true | false | high |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 142.250.184.206 | drive.google.com | United States | 15169 | GOOGLEUS | false | |
| 172.217.16.193 | drive.usercontent.google.com | United States | 15169 | GOOGLEUS | false |
| Joe Sandbox version: | 42.0.0 Malachite |
| Analysis ID: | 1588755 |
| Start date and time: | 2025-01-11 05:11:45 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 7m 0s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Run name: | Run with higher sleep bypass |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | QNuQ5e175D.exerenamed because original name is a hash value |
| Original Sample Name: | e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe |
| Detection: | MAL |
| Classification: | mal68.troj.evad.winEXE@3/5@2/2 |
| EGA Information: |
|
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
- Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
- Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
- Execution Graph export aborted for target QNuQ5e175D.exe, PID 7776 because there are no executed function
- Not all processes where analyzed, report is missing behavior information
- Report size getting too big, too many NtOpenKeyEx calls found.
- Report size getting too big, too many NtQueryValueKey calls found.
⊘No simulations
⊘No context
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | GuLoader | Browse |
| |
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | Nitol, Xmrig | Browse |
| ||
| Get hash | malicious | Nitol | Browse |
| ||
| Get hash | malicious | FormBook, GuLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
| ||
| Get hash | malicious | GuLoader | Browse |
| ||
| Get hash | malicious | Unknown | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\nsk3C2D.tmp\System.dll | Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse | ||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | Unknown | Browse | |||
| Get hash | malicious | AgentTesla, GuLoader | Browse | |||
| Get hash | malicious | AgentTesla, GuLoader | Browse | |||
| Get hash | malicious | GuLoader, Snake Keylogger, VIP Keylogger | Browse | |||
| Get hash | malicious | PureLog Stealer, zgRAT | Browse |
| Process: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 12288 |
| Entropy (8bit): | 5.804946284177748 |
| Encrypted: | false |
| SSDEEP: | 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr |
| MD5: | 192639861E3DC2DC5C08BB8F8C7260D5 |
| SHA1: | 58D30E460609E22FA0098BC27D928B689EF9AF78 |
| SHA-256: | 23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6 |
| SHA-512: | 6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
| Process: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 376884 |
| Entropy (8bit): | 1.2538694993882065 |
| Encrypted: | false |
| SSDEEP: | 1536:eTJcpruMcjYX8Jf2lBD7XWqllCEYyZB0mFS04:eJcpPIYX8JonFS3 |
| MD5: | 943DE1999A45C6772E1F2FB9E1803546 |
| SHA1: | 542FC5B588D85BB0E7FCEED47789836A9C428984 |
| SHA-256: | 1CCAB41F428AAB780F43CA2C25EB80A63755BD7977DFF975ED662FDB9672D515 |
| SHA-512: | A6AC5B8C7A1DBC2F06888E0F9285A6E1BD39A6C35E021BB5E3DC179E1EA176BEDDC7AD8C49CAEDDD7E10E232F980C7186E05DB890E001BA481E24E9D7EE4C434 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 222843 |
| Entropy (8bit): | 7.362565451544298 |
| Encrypted: | false |
| SSDEEP: | 6144:gZ4ZblE1Ev2ugYpg+POgIPWJHbZeowW7H42LK:gZ4ZMEviYpgEHJHbwtKH422 |
| MD5: | 20E1BC5AD88D5F2BE5A58EFC3EA1457B |
| SHA1: | 1099DBD1065F6958A014552FD0DF5D26CFF1CFB7 |
| SHA-256: | 1FC0AA24E14AC6EA316ED1E1293D9F4B9B19047BCD5BAC97B35E2DB1AEDD7246 |
| SHA-512: | F97570AFF8D400CB300E05A4C57A8EA3D016FA9DC2675CAF89BFAB8B6465A2A021AA201B9E2CBD0472136207B4F92E20775EAF81BB0C926549FE7DD452B260D7 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 37114 |
| Entropy (8bit): | 4.648205422140126 |
| Encrypted: | false |
| SSDEEP: | 384:z0GZqpL6AJbzyEyPpyOFYqjG3YL3BM6doOGNblZ9bQZkCC90fFjrBv26dUayacAM:IGKzaZFYqC3500310fhdKtz |
| MD5: | A2C20BC4DA366C09E9FD86704A33CB0C |
| SHA1: | 91A57F0DDBE7C4E7556BA38BB2CFC8C8C5B52CEC |
| SHA-256: | 2BF4E12311D437A5B61F085C80ED3B3A8C29E77674DAC41F4829E4251C3878A1 |
| SHA-512: | 27ADF3C40D1B3583D4104DB2E5A221F0963A25DB7C593426556493EC536C24F2B7866A8B7DF69F8E4127DAE78510B4FC7CAF65660EE2F25EE791C3480E38532B |
| Malicious: | false |
| Preview: |
| Process: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 437967 |
| Entropy (8bit): | 1.2496824675371185 |
| Encrypted: | false |
| SSDEEP: | 768:YszAIbEHsrUdiWwGdV5C+P4/1F93McF1TWcY7hYu4nR/CFxofOrNYSOq5HGieGwO:YJkFhJAhX55ckvF4ULrV2Ehr3gra5 |
| MD5: | 0695A340DE7C3F5F45036C9C9EAFDBD2 |
| SHA1: | D741BBBBFAD62B1D85E87CEDD3F344F4062C33D6 |
| SHA-256: | 0020F3470C29CAC49F8521309D6DA437EC6F71B2F5BD41A7B5DD88788B5AC25F |
| SHA-512: | D2668C1016BBE3DF9CE638D834AA13CC1100D4B85FCB4AC7396DA8166B50F0B2AF0A9025BA35D54A865EC87F356EEEB7A577B000B9B50F8ECC996B3E798CF145 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 7.407220190167989 |
| TrID: |
|
| File name: | QNuQ5e175D.exe |
| File size: | 585'064 bytes |
| MD5: | 9bb2cdb8508ee2255a35ecec43462a48 |
| SHA1: | c7465e8b0a3ae61b23520752afbb8bf89a3cecdd |
| SHA256: | e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa |
| SHA512: | 0b8e8399eb04372c1cb70467dca25078ab255d01c448fa7ccabd620d9066306a1127c4e5caa4af66226662bb3b2d143045b9212332e7408c7b97ea40672a0ac1 |
| SSDEEP: | 12288:ifYfUlNHYh6EEfqUhn5i5mfQAsS+6ePZxIgLF7eEbH+aj:ifYMPYcqUhY5mp9+6ehxIg5H9j |
| TLSH: | E0C4F0257614AC5AC4EC10358BDDDE7B07630F6A7B6C521F73C4BE4C7AB9A816922323 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j......... |
 | |
| Icon Hash: | 016c4c4ebe99dd65 |
| Entrypoint: | 0x403552 |
| Entrypoint Section: | .text |
| Digitally signed: | true |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE |
| DLL Characteristics: | DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE |
| Time Stamp: | 0x660843FB [Sat Mar 30 16:55:23 2024 UTC] |
| TLS Callbacks: | |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f4639a0b3116c2cfc71144b88a929cfd |
| Signature Valid: | false |
| Signature Issuer: | CN=nonconverging, O=nonconverging, L=Cliff, C=US |
| Signature Validation Error: | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider |
| Error Number: | -2146762487 |
| Not Before, Not After |
|
| Subject Chain |
|
| Version: | 3 |
| Thumbprint MD5: | B0E922076FFE2DF5FE70C6AC8CD556A2 |
| Thumbprint SHA-1: | CE784EA178F07EE5869E76F3117DD8B531152C79 |
| Thumbprint SHA-256: | B8488CDBED36172DB2D61C9AB8ED59564E9285624F8AE446AA90892EF78FB1EC |
| Serial: | 5A5D66BB316E150417CDF6D37A5D77AE424A4754 |
| Instruction |
|---|
| sub esp, 000003F8h |
| push ebp |
| push esi |
| push edi |
| push 00000020h |
| pop edi |
| xor ebp, ebp |
| push 00008001h |
| mov dword ptr [esp+20h], ebp |
| mov dword ptr [esp+18h], 0040A2D8h |
| mov dword ptr [esp+14h], ebp |
| call dword ptr [004080A4h] |
| mov esi, dword ptr [004080A8h] |
| lea eax, dword ptr [esp+34h] |
| push eax |
| mov dword ptr [esp+4Ch], ebp |
| mov dword ptr [esp+0000014Ch], ebp |
| mov dword ptr [esp+00000150h], ebp |
| mov dword ptr [esp+38h], 0000011Ch |
| call esi |
| test eax, eax |
| jne 00007FB628EDEE4Ah |
| lea eax, dword ptr [esp+34h] |
| mov dword ptr [esp+34h], 00000114h |
| push eax |
| call esi |
| mov ax, word ptr [esp+48h] |
| mov ecx, dword ptr [esp+62h] |
| sub ax, 00000053h |
| add ecx, FFFFFFD0h |
| neg ax |
| sbb eax, eax |
| mov byte ptr [esp+0000014Eh], 00000004h |
| not eax |
| and eax, ecx |
| mov word ptr [esp+00000148h], ax |
| cmp dword ptr [esp+38h], 0Ah |
| jnc 00007FB628EDEE18h |
| and word ptr [esp+42h], 0000h |
| mov eax, dword ptr [esp+40h] |
| movzx ecx, byte ptr [esp+3Ch] |
| mov dword ptr [004347B8h], eax |
| xor eax, eax |
| mov ah, byte ptr [esp+38h] |
| movzx eax, ax |
| or eax, ecx |
| xor ecx, ecx |
| mov ch, byte ptr [esp+00000148h] |
| movzx ecx, cx |
| shl eax, 10h |
| or eax, ecx |
| movzx ecx, byte ptr [esp+0000004Eh] |
| Programming Language: |
|
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x8608 | 0xa0 | .rdata |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x68000 | 0x2ac78 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x8e460 | 0x908 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x8000 | 0x2a8 | .rdata |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | MD5 | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x68f8 | 0x6a00 | 595406ea4e71ef6f8675a1bd30bcc8f9 | False | 0.6703272405660378 | data | 6.482222402519068 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ |
| .rdata | 0x8000 | 0x1464 | 0x1600 | a995b118b38426885fc6ccaa984c8b7a | False | 0.4314630681818182 | data | 4.969091535632612 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| .data | 0xa000 | 0x2a818 | 0x600 | 7a91ec9f1c18e608c3f3f503ba4191c1 | False | 0.5221354166666666 | data | 4.165541189894117 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .ndata | 0x35000 | 0x33000 | 0x0 | d41d8cd98f00b204e9800998ecf8427e | False | 0 | empty | 0.0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE |
| .rsrc | 0x68000 | 0x2ac78 | 0x2ae00 | 07533466c1ba02253abde419e160f487 | False | 0.43160076530612246 | data | 5.193823090904089 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country | ZLIB Complexity |
|---|---|---|---|---|---|---|
| RT_ICON | 0x68448 | 0x10828 | Device independent bitmap graphic, 128 x 256 x 32, image size 67584 | English | United States | 0.3483526558618242 |
| RT_ICON | 0x78c70 | 0x94a8 | Device independent bitmap graphic, 96 x 192 x 32, image size 38016 | English | United States | 0.44647361782636114 |
| RT_ICON | 0x82118 | 0x5488 | Device independent bitmap graphic, 72 x 144 x 32, image size 21600 | English | United States | 0.4737060998151571 |
| RT_ICON | 0x875a0 | 0x4228 | Device independent bitmap graphic, 64 x 128 x 32, image size 16896 | English | United States | 0.44355219650448746 |
| RT_ICON | 0x8b7c8 | 0x25a8 | Device independent bitmap graphic, 48 x 96 x 32, image size 9600 | English | United States | 0.5286307053941909 |
| RT_ICON | 0x8dd70 | 0x10a8 | Device independent bitmap graphic, 32 x 64 x 32, image size 4224 | English | United States | 0.5811444652908068 |
| RT_ICON | 0x8ee18 | 0xea8 | Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors | English | United States | 0.5748933901918977 |
| RT_ICON | 0x8fcc0 | 0x988 | Device independent bitmap graphic, 24 x 48 x 32, image size 2400 | English | United States | 0.6860655737704918 |
| RT_ICON | 0x90648 | 0x8a8 | Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors | English | United States | 0.7224729241877257 |
| RT_ICON | 0x90ef0 | 0x668 | Device independent bitmap graphic, 48 x 96 x 4, image size 1152 | English | United States | 0.49146341463414633 |
| RT_ICON | 0x91558 | 0x568 | Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors | English | United States | 0.5440751445086706 |
| RT_ICON | 0x91ac0 | 0x468 | Device independent bitmap graphic, 16 x 32 x 32, image size 1088 | English | United States | 0.7668439716312057 |
| RT_ICON | 0x91f28 | 0x2e8 | Device independent bitmap graphic, 32 x 64 x 4, image size 512 | English | United States | 0.6263440860215054 |
| RT_ICON | 0x92210 | 0x128 | Device independent bitmap graphic, 16 x 32 x 4, image size 128 | English | United States | 0.7128378378378378 |
| RT_DIALOG | 0x92338 | 0x100 | data | English | United States | 0.5234375 |
| RT_DIALOG | 0x92438 | 0x11c | data | English | United States | 0.6091549295774648 |
| RT_DIALOG | 0x92558 | 0x60 | data | English | United States | 0.7291666666666666 |
| RT_GROUP_ICON | 0x925b8 | 0xca | data | English | United States | 0.6237623762376238 |
| RT_VERSION | 0x92688 | 0x2b0 | data | English | United States | 0.5232558139534884 |
| RT_MANIFEST | 0x92938 | 0x33e | XML 1.0 document, ASCII text, with very long lines (830), with no line terminators | English | United States | 0.5542168674698795 |
| DLL | Import |
|---|---|
| ADVAPI32.dll | RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW |
| SHELL32.dll | SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW |
| ole32.dll | CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree |
| COMCTL32.dll | ImageList_Destroy, ImageList_AddMasked, ImageList_Create |
| USER32.dll | MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics |
| GDI32.dll | GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor |
| KERNEL32.dll | lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node| Timestamp | SID | Signature | Severity | Source IP | Source Port | Dest IP | Dest Port | Protocol |
|---|---|---|---|---|---|---|---|---|
| 2025-01-11T05:13:09.535463+0100 | 2803270 | ETPRO MALWARE Common Downloader Header Pattern UHCa | 2 | 192.168.2.4 | 49736 | 142.250.184.206 | 443 | TCP |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 05:13:08.257000923 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:08.257042885 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:08.257121086 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:08.272598028 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:08.272630930 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:08.924170017 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:08.924292088 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:08.924958944 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:08.925093889 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.225027084 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.225048065 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.225431919 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.225709915 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.236819983 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.283324957 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.535450935 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.535510063 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.535531998 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.535734892 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.535734892 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.535768986 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.535911083 CET | 443 | 49736 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.535917997 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.536170006 CET | 49736 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:09.559186935 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:09.559227943 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.559297085 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:09.559590101 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:09.559600115 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.212208986 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.212301016 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.216110945 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.216131926 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.216382027 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.219861031 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.220212936 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.263344049 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.638128996 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.638200998 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.638269901 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:10.638366938 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.638366938 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.644879103 CET | 49737 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:10.644906998 CET | 443 | 49737 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:20.664839983 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:20.664882898 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:20.664946079 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:20.665188074 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:20.665205002 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.300605059 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.300694942 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.301402092 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.301464081 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.303195000 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.303204060 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.303468943 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.303523064 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.303930998 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.347372055 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.680197001 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.680409908 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.680422068 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.680478096 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.680541992 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.680583000 CET | 443 | 49738 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.680636883 CET | 49738 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:21.692074060 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:21.692123890 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:21.692208052 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:21.692485094 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:21.692501068 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.343306065 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.343411922 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.344012022 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.344024897 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.344279051 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.344285965 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.759047031 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.759114027 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.759179115 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:22.759181976 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.759219885 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.759243965 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.759860992 CET | 49739 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:22.759881020 CET | 443 | 49739 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:32.772690058 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:32.772743940 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:32.772820950 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:32.773215055 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:32.773228884 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.416091919 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.416258097 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.418809891 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.418890953 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.423162937 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.423177004 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.423521996 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.423628092 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.423942089 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.467330933 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.903237104 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.903361082 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.903382063 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.903422117 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.903527021 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.903752089 CET | 443 | 49740 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.903816938 CET | 49740 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:33.912990093 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:33.913026094 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:33.913094044 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:33.913336039 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:33.913355112 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.546443939 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.546531916 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.547009945 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.547017097 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.547247887 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.547252893 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.963939905 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.964010954 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.964015007 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.964031935 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.964055061 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.964077950 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.964082956 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:34.964124918 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.964668989 CET | 49741 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:34.964684010 CET | 443 | 49741 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:44.976455927 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:44.976497889 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:44.978017092 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:44.978187084 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:44.978200912 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.635907888 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.636693954 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.636753082 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.636753082 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.636775017 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.638657093 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.638657093 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.638664961 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.638956070 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:45.639343977 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.639343977 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:45.683321953 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.024167061 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.024235964 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:46.024245977 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.024281979 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:46.024419069 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:46.024456024 CET | 443 | 49805 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.024496078 CET | 49805 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:46.031303883 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.031344891 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.031409025 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.031600952 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.031611919 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.703594923 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.703764915 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.704233885 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.704263926 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:46.704427004 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:46.704441071 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121601105 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121701002 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.121769905 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121809006 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121829987 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.121850014 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121881962 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.121922016 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.121932983 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.121980906 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.121995926 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:47.122049093 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.122658014 CET | 49812 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:47.122694016 CET | 443 | 49812 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.158864975 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.158885002 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.158951044 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.180697918 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.180715084 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.898602009 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.898727894 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.899703979 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.899780989 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.901293993 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.901302099 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.901629925 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:57.901684046 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.902039051 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:57.943331003 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.282979012 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.283070087 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:58.283133984 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.283210993 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:58.283323050 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:58.283404112 CET | 443 | 49886 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.283473015 CET | 49886 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:13:58.299140930 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.299170017 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.299235106 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.299627066 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.299639940 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.960295916 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.960370064 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.960746050 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.960752010 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:58.960943937 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:58.960948944 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414283037 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414354086 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.414362907 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414376020 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414411068 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.414417982 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414431095 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.414453983 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:13:59.414462090 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.414504051 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.415013075 CET | 49894 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:13:59.415020943 CET | 443 | 49894 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:09.429573059 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:09.429608107 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:09.429676056 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:09.429929018 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:09.429944038 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.077197075 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.077363014 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.080077887 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.080147028 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.081974030 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.081983089 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.082365990 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.082427025 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.082861900 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.123322010 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.456926107 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.456998110 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.457012892 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.457093000 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.457187891 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.457235098 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.457397938 CET | 443 | 49968 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.457401037 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.457448959 CET | 49968 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:10.473184109 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:10.473229885 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:10.473300934 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:10.473592043 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:10.473611116 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.101465940 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.101916075 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.102277040 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.102286100 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.102540970 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.102547884 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.524039030 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.524127960 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.524202108 CET | 443 | 49975 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:11.524347067 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.527869940 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.527869940 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:11.527898073 CET | 49975 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:21.538546085 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:21.538609982 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:21.538724899 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:21.539169073 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:21.539184093 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.170948982 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.171180010 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.171745062 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.171813965 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.173774004 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.173796892 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.174061060 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.174113989 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.174572945 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.215344906 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.559890985 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.560069084 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.560170889 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.560205936 CET | 443 | 50014 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.560261965 CET | 50014 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:22.567557096 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:22.567595005 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:22.567682028 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:22.567903042 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:22.567914009 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.219281912 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.219388008 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.219903946 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.219916105 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.220082045 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.220087051 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.642601967 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.642673016 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.642718077 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.642736912 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.642748117 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.642749071 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:23.642786026 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.643443108 CET | 50015 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:23.643462896 CET | 443 | 50015 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:33.663480043 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:33.663528919 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:33.663661003 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:33.664045095 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:33.664072037 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.299854994 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.300038099 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.300651073 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.300795078 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.305495024 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.305514097 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.305830002 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.305885077 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.306766987 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.347352028 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.691972971 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.692316055 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.692382097 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.692465067 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.692514896 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.692651033 CET | 443 | 50016 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.692800999 CET | 50016 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:34.699543953 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:34.699579000 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:34.699656963 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:34.699872017 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:34.699882984 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.350193024 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.350249052 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.350657940 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.350672960 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.350838900 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.350843906 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.775747061 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.775827885 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.775849104 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.775871038 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.775880098 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.775927067 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:35.775928020 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.775974989 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.776525974 CET | 50017 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:35.776542902 CET | 443 | 50017 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:45.794132948 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:45.794178963 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:45.794234037 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:45.795047045 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:45.795057058 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.448991060 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.449094057 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.449812889 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.449861050 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.451493025 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.451508045 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.451778889 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.451821089 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.452331066 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.495341063 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.840450048 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.840707064 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.840723038 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.840831041 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.841183901 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.841229916 CET | 443 | 50018 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.841279030 CET | 50018 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:46.856570959 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:46.856633902 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:46.856729984 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:46.857117891 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:46.857131958 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.496181011 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.496315002 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.499134064 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.499142885 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.499361992 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.499367952 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.968718052 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.968782902 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.968806028 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.968820095 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.968831062 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.968872070 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.969280005 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:47.969319105 CET | 443 | 50019 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:47.969379902 CET | 50019 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:57.991849899 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:57.991894960 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:57.992000103 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:57.992403984 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:57.992414951 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:58.729253054 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:58.729324102 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:58.730011940 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:58.730076075 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:58.732019901 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:58.732028961 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:58.732263088 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:58.732312918 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:58.732729912 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:58.775336027 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.116580009 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.116645098 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:59.116667032 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.116708994 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:59.116929054 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:59.116970062 CET | 443 | 50020 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.117022038 CET | 50020 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:14:59.121263027 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.121295929 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.121378899 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.121598005 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.121608019 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.770848036 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.770968914 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.772833109 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.772842884 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.773159981 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:14:59.773211956 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.773706913 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:14:59.815366983 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195310116 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195384979 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195410967 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.195425987 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195437908 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.195475101 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.195480108 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195508957 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:00.195518970 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.195550919 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.196166992 CET | 50021 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:00.196180105 CET | 443 | 50021 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.210444927 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.210491896 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.210602045 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.211008072 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.211019039 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.857675076 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.857803106 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.858474016 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.858550072 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.860014915 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.860024929 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.860260963 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:10.860307932 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.860605001 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:10.903331995 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.252351046 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.252486944 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:11.252509117 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.252557993 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:11.252697945 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:11.252734900 CET | 443 | 50022 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.252788067 CET | 50022 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:11.257592916 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.257637024 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.257728100 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.257977962 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.257991076 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.894073009 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.894131899 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.894716024 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.894722939 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:11.894944906 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:11.894951105 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:12.324805021 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:12.324866056 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:12.324911118 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:12.324923992 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:12.324940920 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:12.324975967 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:12.324985027 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:12.325021982 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:12.325597048 CET | 50023 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:12.325611115 CET | 443 | 50023 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.336889029 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.336920977 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.337007999 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.337608099 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.337621927 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.993096113 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.993189096 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.993917942 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.994282007 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.996448040 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.996455908 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.996726036 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:22.996778011 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:22.997122049 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:23.039365053 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:23.381442070 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:23.381510973 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:23.381520987 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:23.381577015 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:23.381732941 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:23.381767988 CET | 443 | 50024 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:23.381829023 CET | 50024 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:23.387370110 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:23.387397051 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:23.387470961 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:23.387687922 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:23.387700081 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.025940895 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.026103020 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.026644945 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.026649952 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.026827097 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.026833057 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.486946106 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.487021923 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.487046957 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.487061024 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.487085104 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:24.487092972 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.487108946 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.487145901 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.487659931 CET | 50025 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:24.487673044 CET | 443 | 50025 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:34.508030891 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:34.508084059 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:34.508155107 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:34.508481026 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:34.508491039 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.147130966 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.147350073 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.148000956 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.148057938 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.201793909 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.201814890 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.202069998 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.202117920 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.202449083 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.243330002 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.531332970 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.531440973 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.531461000 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.531507969 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.531563997 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.531599998 CET | 443 | 50026 | 142.250.184.206 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.531658888 CET | 50026 | 443 | 192.168.2.4 | 142.250.184.206 |
| Jan 11, 2025 05:15:35.536382914 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:35.536427975 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:35.536489964 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:35.536789894 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:35.536803007 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.193505049 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.193587065 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.194144011 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.194152117 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.194305897 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.194310904 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.616132021 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.616199017 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.616219997 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.616250038 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.616266966 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.616348028 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.616395950 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.616995096 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.617012978 CET | 443 | 50027 | 172.217.16.193 | 192.168.2.4 |
| Jan 11, 2025 05:15:36.617026091 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Jan 11, 2025 05:15:36.617054939 CET | 50027 | 443 | 192.168.2.4 | 172.217.16.193 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Jan 11, 2025 05:13:08.244750977 CET | 56148 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jan 11, 2025 05:13:08.251501083 CET | 53 | 56148 | 1.1.1.1 | 192.168.2.4 |
| Jan 11, 2025 05:13:09.551736116 CET | 54283 | 53 | 192.168.2.4 | 1.1.1.1 |
| Jan 11, 2025 05:13:09.558438063 CET | 53 | 54283 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 05:13:08.244750977 CET | 192.168.2.4 | 1.1.1.1 | 0xaeb6 | Standard query (0) | A (IP address) | IN (0x0001) | false | |
| Jan 11, 2025 05:13:09.551736116 CET | 192.168.2.4 | 1.1.1.1 | 0xd852 | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Jan 11, 2025 05:13:08.251501083 CET | 1.1.1.1 | 192.168.2.4 | 0xaeb6 | No error (0) | 142.250.184.206 | A (IP address) | IN (0x0001) | false | ||
| Jan 11, 2025 05:13:09.558438063 CET | 1.1.1.1 | 192.168.2.4 | 0xd852 | No error (0) | 172.217.16.193 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49736 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:09 UTC | 216 | OUT | |
| 2025-01-11 04:13:09 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49737 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:10 UTC | 258 | OUT | |
| 2025-01-11 04:13:10 UTC | 2230 | IN | |
| 2025-01-11 04:13:10 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49738 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:21 UTC | 422 | OUT | |
| 2025-01-11 04:13:21 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 3 | 192.168.2.4 | 49739 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:22 UTC | 464 | OUT | |
| 2025-01-11 04:13:22 UTC | 1851 | IN | |
| 2025-01-11 04:13:22 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 4 | 192.168.2.4 | 49740 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:33 UTC | 422 | OUT | |
| 2025-01-11 04:13:33 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 5 | 192.168.2.4 | 49741 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:34 UTC | 464 | OUT | |
| 2025-01-11 04:13:34 UTC | 1851 | IN | |
| 2025-01-11 04:13:34 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 6 | 192.168.2.4 | 49805 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:45 UTC | 422 | OUT | |
| 2025-01-11 04:13:46 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 7 | 192.168.2.4 | 49812 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:46 UTC | 464 | OUT | |
| 2025-01-11 04:13:47 UTC | 1844 | IN | |
| 2025-01-11 04:13:47 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 8 | 192.168.2.4 | 49886 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:57 UTC | 422 | OUT | |
| 2025-01-11 04:13:58 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 9 | 192.168.2.4 | 49894 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:13:58 UTC | 464 | OUT | |
| 2025-01-11 04:13:59 UTC | 1851 | IN | |
| 2025-01-11 04:13:59 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 10 | 192.168.2.4 | 49968 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:10 UTC | 422 | OUT | |
| 2025-01-11 04:14:10 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 11 | 192.168.2.4 | 49975 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:11 UTC | 464 | OUT | |
| 2025-01-11 04:14:11 UTC | 1851 | IN | |
| 2025-01-11 04:14:11 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 12 | 192.168.2.4 | 50014 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:22 UTC | 422 | OUT | |
| 2025-01-11 04:14:22 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 13 | 192.168.2.4 | 50015 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:23 UTC | 464 | OUT | |
| 2025-01-11 04:14:23 UTC | 1844 | IN | |
| 2025-01-11 04:14:23 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 14 | 192.168.2.4 | 50016 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:34 UTC | 422 | OUT | |
| 2025-01-11 04:14:34 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 15 | 192.168.2.4 | 50017 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:35 UTC | 464 | OUT | |
| 2025-01-11 04:14:35 UTC | 1844 | IN | |
| 2025-01-11 04:14:35 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 16 | 192.168.2.4 | 50018 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:46 UTC | 422 | OUT | |
| 2025-01-11 04:14:46 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 17 | 192.168.2.4 | 50019 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:47 UTC | 464 | OUT | |
| 2025-01-11 04:14:47 UTC | 1851 | IN | |
| 2025-01-11 04:14:47 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 18 | 192.168.2.4 | 50020 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:58 UTC | 422 | OUT | |
| 2025-01-11 04:14:59 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 19 | 192.168.2.4 | 50021 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:14:59 UTC | 464 | OUT | |
| 2025-01-11 04:15:00 UTC | 1844 | IN | |
| 2025-01-11 04:15:00 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 20 | 192.168.2.4 | 50022 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:10 UTC | 422 | OUT | |
| 2025-01-11 04:15:11 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 21 | 192.168.2.4 | 50023 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:11 UTC | 464 | OUT | |
| 2025-01-11 04:15:12 UTC | 1851 | IN | |
| 2025-01-11 04:15:12 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 22 | 192.168.2.4 | 50024 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:22 UTC | 422 | OUT | |
| 2025-01-11 04:15:23 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 23 | 192.168.2.4 | 50025 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:24 UTC | 464 | OUT | |
| 2025-01-11 04:15:24 UTC | 1851 | IN | |
| 2025-01-11 04:15:24 UTC | 1652 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 24 | 192.168.2.4 | 50026 | 142.250.184.206 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:35 UTC | 422 | OUT | |
| 2025-01-11 04:15:35 UTC | 1920 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 25 | 192.168.2.4 | 50027 | 172.217.16.193 | 443 | 7776 | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2025-01-11 04:15:36 UTC | 464 | OUT | |
| 2025-01-11 04:15:36 UTC | 1851 | IN | |
| 2025-01-11 04:15:36 UTC | 1652 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 23:12:39 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 585'064 bytes |
| MD5 hash: | 9BB2CDB8508EE2255A35ECEC43462A48 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 23:13:02 |
| Start date: | 10/01/2025 |
| Path: | C:\Users\user\Desktop\QNuQ5e175D.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 585'064 bytes |
| MD5 hash: | 9BB2CDB8508EE2255A35ECEC43462A48 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Yara matches: |
|
| Reputation: | low |
| Has exited: | false |
Execution Graph
| Execution Coverage: | 22.3% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 16% |
| Total number of Nodes: | 1575 |
| Total number of Limit Nodes: | 40 |
Graph
Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464stringfilecomCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040573B Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC41BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148filestringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403FF7 Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181memoryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204stringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Control-flow Graph
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
Download Yara Rule
Control-flow Graph
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004056CF Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405ACB Relevance: 3.0, APIs: 2, Instructions: 26COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401598 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC42B98 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004016A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC42A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402419 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004015C8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404542 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040452B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405B9D Relevance: 1.5, APIs: 1, Instructions: 6COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404518 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049E7 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00406DE6 Relevance: .3, Instructions: 334COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004075BD Relevance: .3, Instructions: 300COMMON
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004046B5 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 204windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC42480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC42655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC41979 Relevance: 7.7, APIs: 5, Instructions: 194COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC416BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405F4E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 6FC410E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403552 Relevance: 72.2, APIs: 32, Strings: 9, Instructions: 464stringfilecomCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405C83 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00403C49 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004046B5 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004049E7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004030A2 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 181memoryCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004065B4 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204stringCOMMON
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
Download Yara Rule
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|